Microsoft Patches Actively Exploited SharePoint Zero-Day in Massive Update, as Critical Flaws in Nginx-UI and Axios Emerge

Further investigation into the Booking.com data breach reveals that attackers leveraged a sophisticated phishing technique known as 'ClickFix'. This method involved tricking hotel employees into installing malicious software, disguised as a legitimate tool, onto their systems. Once installed, the malware allowed threat actors to harvest credentials for the hotel's management systems, including the Booking.com partner portal. This enabled the unauthorized access and scraping of customer reservation data, confirming a supply chain attack vector where smaller partners were targeted to breach the larger platform's data.

The vulnerability, CVE-2026-33032, is confirmed to be actively exploited by threat intelligence firm Recorded Future. Scans reveal over 2,600 publicly accessible and potentially vulnerable nginx-ui instances, primarily in China, the US, Indonesia, Germany, and Hong Kong. An additional interim mitigation involves disabling the MCP functionality within nginx-ui if not in use, which removes the vulnerable endpoint. Security teams should also monitor for specific cyber observables, including requests to '/mcp_message' and unauthorized changes to Nginx configuration files.

A new report from GuidePoint Security covering Q1 2026 indicates ransomware activity has stabilized at the high levels of 2025, establishing an 'elevated new normal'. While Qilin's activity dipped by 25% from Q4 2025, a new group, 'The Gentlemen', surged to become the second most prolific with 182 victims. Akira's activity also declined. The construction sector saw a 44% year-over-year increase in attacks, highlighting evolving targeting trends and the persistent, high-volume threat.